GPSolo Magazine - September 2004

Practice Management

Special Handling: How Paper and Electronic Files Differ

By Toby Brown

To better understand the emerging legal landscape of electronic-based information, most of us must first better understand the difference between paper files and electronic data, especially as it relates to the destruction of existing data. When a piece of law-related paper is discarded, it is typically thrown away or shredded and carted off to the local landfill. The likelihood of an individual’s coming into possession of a discarded paper document is extremely low, and shredding makes it virtually impossible. Too bad the electronic file paradigm doesn’t follow this simplistic resolution.

When you delete an electronic file, it’s actually still there. The process of deletion only removes the name of the document from the filing index—like removing a card from the library’s old card catalog system. The corresponding book is still on the shelf and accessible to those who know how to find it.

Forensics experts. A number of vendors now specialize in “computer forensics”—the process of finding and retrieving deleted electronic files. Most of these vendors serve the emerging e-discovery market because discovery is the legal event that usually triggers the search for deleted information. A defined process for finding deleted material is required to maintain the integrity of the information and put it in a producible form for discovery requests, depositions, and court proceedings. This process includes acquiring the data, indexing and organizing the data for review, creating images (for further review, coding, and presentation), and loading the data and images into a database for ongoing search and retrieval.

Acquisition. Acquiring information from a hard drive is not as simple as making a copy of its files. Hiring a forensics expert is essential. An important part of computer forensics is trusting that the retrieved data did in fact originally exist and was not created during the forensics process. A bit-by-bit image of the hard drive is necessary, and the bits must not be altered during the process. Merely turning on a computer can change the bit-level information—using a forensics expert is your guarantee that no evidence is spoiled. With this bit-by-bit reproduction of a hard drive, an expert can begin reconstructing deleted information to prepare for the next step.

Indexing. The forensics expert next creates an index of the retrieved information. To return to the paper analogy: The information retrieved from the hard drive is equivalent to a file room that contains all recently discarded files. Opposing counsel would never be allowed to fish through such a file room. So, first the attorney must review the retrieved information to see whether it matches the discovery requests and whether it might contain privileged information. The lawyer can use the index to do this initial review. In some cases, the review might require the documents themselves, and deleted information would need to be recombined into readable files. Again, you should have this done by a certified forensics expert so that the information can be trusted. This is especially a problem for reconstructed e-mail. Unlike a word-processing file, e-mail is made up of separate data files that are “put together” with your e-mail software. It’s essential that these separate data points be carefully recombined so that the result is actually a valid file.

Production and metadata. The information delivered by forensics experts must not only be reliable, it must also be useful. “Useful” in this context means you have a collection of image files along with the corresponding metadata retrieved from the file systems. Metadata is data about data. Many electronic files include metadata within the files themselves—a double-edged sword for lawyers. On the good side, you can more easily index the discovery data. If you know who was listed in the “To” and “CC” fields for a collection of e-mails, you can easily create an electronic index of addressees and copied recipients.

On the bad side, metadata can lead to ethics problems. Let’s return to the “paper world” again. Paper can be “dumb.” Paper contains only the data you see. It is not smart enough to know where all of its information came from, which means it is unable to reveal its secrets. In contrast, electronic files are “smart” because they contain metadata. For example, Microsoft Word includes metadata for every file. Clicking the File pull-down menu in an open document and selecting Properties reveals some of this metadata. Depending on your Word configuration, Properties may reveal a client’s name or confidences, especially if the file was created by modifying an already existing document. The metadata may reveal information from the original file as well as the current document.

Compounding the metadata trail, Word also has a feature called Fast Saves, which is very useful in the event of hardware failure because it reduces the chance of losing changes to a document. However, when the Fast Saves option is enabled, deleted information remains hidden within the document. For example, say a lawyer pulls up the Word file of a contract from a past deal, adapts it to the current situation, and e-mails a copy to the opposing side. The opposing counsel opens the document with another program, such as Notepad—and all of the deleted information from the original deal appears.

Other metadata traps exist. Using the Reviewing or Versioning features to track changes can mean that deleted information will be retained. Using the Comment feature may plant confidential information somewhere inside the document.

Lawyers obviously must be very careful about the metadata contained within their own and client files. The ethics dialogue on this issue has been quite interesting. The primary issue is pretty clear-cut: Lawyers who reveal client confidences get disciplined. Find and eliminate any metadata that could compromise your clients’ interests before you share electronic files via e-mail or in an e-discovery production.

The next obvious question is how can you get rid of metadata. First, consider that metadata exists in other file types in addition to word processing—spreadsheets, for example. Software programs are now available that can help you deal with this problem. One version from Payne Consulting (www.payneconsulting.com), Metadata Assistant, works with both Word and Excel. Another option, the poor man’s approach to removing metadata, is to save the documents in PDF or RTF file formats. The PDF approach does a better job of preserving formatting but produces a larger file size; the RTF approach results in a smaller file but might well lose some formatting.

The metadata issue further de-monstrates that paper and electronic documents definitely are different. Lawyers must treat the two differently to fully protect client information.

Bringing it all together. Having a better understanding of electronic documents should help you come up with policy decisions that will aid both you and your clients. It is prudent to think about and set policies that will best protect the client data you hold. For instance, what happens to old computers? Now that you know how much client data may exist on the hard drive, you might want to implement a policy for wiping or destroying hard drives before they leave your office.

Finally, consider offering assistance to your clients by helping them to establish appropriate protocols in handling electronic business communications. A good place to start would be helping clients implement sound e-mail policies. Informed information management policies will further reduce the discoverability of client e-mail in the future

Toby Brown is director of communications for the Utah State Bar. He can be reached attoby@utahbar.org.

for more information about the Tort Trial and Insurance Practice Section

- This article is an abridged and edited version of one that originally appeared on page 28 of The Brief, Winter 2004 (33:2).

- For more information or to obtain a copy of the periodical in which the full article appears, please call the ABA Service Center at 800/285-2221.